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Abstract —This paper studies the private key generation of 
a cooperative pairwise-independent network (PIN) with M + 2 
terminals (Alice, Boh and M relays), M > 2. In this PIN, 
the correlated sources observed hy every pair of terminals are 
independent of those sources observed by any other pair of 
terminal. All the terminals can communicate with each other over 
a public channel which is also observed by Eve noiselessly. The 
objective is to generate a private key between Alice and Bob nnder 
the help of the M relays; such a private key needs to be protected 
not only from Eve but also from individual relays simultaneously. 
The private key capacity of this PIN model is established, whose 
lower bound is obtained by proposing a novel random binning 
(RB) based key generation algorithm, and the upper bound is 
obtained based on the construction of M enhanced source models. 
The two bounds are shown to be exactly the same. Then, we 
consider a cooperative wireless network and nse the estimates of 
fading channels to generate private keys. It has been shown that 
the proposed RB-based algorithm can achieve a multiplexing gain 
M — 1, an Improvement in comparison with the existing XOR- 
based algorithm whose achievable multiplexing gain is [M] /2. 

Index Terms —PIN model. Private key capacity. Multiplexing 
gain 

I. Introduction 

The pairwise-independent network (PIN) was introduced in 
m for secret key generation. Since then, many other related 
works have also investigated a variety of PIN models (e.g., El- 
113), and each of them aimed to find the secret key capacity of 
a particular PIN model. The PIN model is actually a special 
case of the multi-terminal “source model’ ’ 0, 0, in which 
the correlated sources observed by every pair of terminals are 
independent of those sources observed by any other pair of 
terminal. Note that the so-call “source model” was first studied 
by Ahlswede and Csisar for generating secret keys between 
two terminals using their correlative observations and public 
transmissions 0. 

In recent years, the PIN model has been applied to practical 
wireless communication networks for key generation. Based 
on channel reciprocity, the correlated source observations in a 
PIN model can be obtained via estimating the wireless fading 
channels associated with legitimate terminals. This is because 
all the wireless channels in a network are mutually independent 
as long as the terminals are half-wavelength away from each 
other 0. This physical layer (PHY) security approach has been 
recognized as a promising solution for generating secret key 
in recent years (e.g., 0-112). 

Existing works have demonstrated that user cooperation can 
effectively enlarge the key capacity by introducing additional 
helper nodes for cooperative key generation 0, m, HI. 
The work in 0 first studied cooperative key generation 
(including the generation of secret keys and private keys) 
in a single-helper discrete memoryless source (DMS) model, 
where the private key needs to be protected not only from 


the eavesdropper but also from all the helper node. The works 
in im. III utilized estimates of wireless channels for the 
key generation in cooperative wireless networks, in which the 
relay nodes provide additional resources of wireless fading 
channels. In im, a relay-assisted algorithm was proposed to 
enhance the secret key rate for the scenario without secrecy 
constraints at relays, and then an XOR-based algorithm was 
proposed to generate a relay-oblivious key, (i.e., private key). 
In uni, a multi-antenna relay was considered to help the 
legitimate terminals to generate a secret key, and then the 
optimal attacker’s strategy was characterized to minimize the 
secret key rate when Eve is an active attacker. 

The problem of private key generation is investigated in this 
paper. We consider a particular cooperative PIN model with 
M + 2 terminals (Alice, Bob, M relays) and an eavesdropper 
(Eve), where M >2. Under the help of relays, Alice and Bob 
wish to establish a private key which should be protected from 
not only Eve but also from individual relays simultaneously. 
One of the main contributions of this paper is to find the 
private key capacity of this PIN model. To obtain the lower 
bound, we propose a novel algorithm for generating the private 
key. Specifically, using the observations at relays and the 
transmissions over the public channel, Alice and Bob first 
agree on M common messages, each of which is open to 
a certain relay. Then a random binning process is adopted 
in the key distillation step to map these insecure common 
messages into a private key. Such an algorithm is termed as 
the “RB-based algorithm” for simplicity. On the other hand, 
the upper bound of the private key capacity is obtained by 
considering M enhanced source models, each of which relaxes 
the secrecy constraints on some relays, and assumes that the 
relay observations are known by Alice or Bob in advance. Such 
an upper bound is tight and matches with the lower bound. 

The proposed RB-based private key generation algorithm 
in the PIN model can be extended to more practical wire¬ 
less communications. In particular, we consider a cooperative 
wireless network, in which Alice, Bob and the M relays 
use estimates of wireless channels as the correlative source 
observations. It is assumed that Alice and Bob are far away 
from each other, so there does not exist the direct link between 
Alice and Bob. Compared to the XOR-based algorithm in ifTTll 
whose multiplexing gain is [Mj/2 for the considered wireless 
network, the proposed RB-based algorithm achieves a larger 
multiplexing gain M — 1. 

II. Pairwise Independent Network Model 

Consider a DMS model, where Alice and Bob, with the help 
of M > 2 relays, wish to establish a private key that needs to 
be protected from Eve and individual relays simultaneously. All 
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relays are assumed to be curious but honest: they will comply 
with the proposed transmission schemes for helping Alice and 
Bob to generate a key, but would also try to intercept the key 
information if they can M. The nodes can communicate to 
each other over a noiseless public channel whose capacity is 
infinite, but the transmitted information over the public channel 
is also available to Eve noiselessly. Eve is passive in the sense 
that it only receives but not transmits information. 


Relay 1 
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x: 



Bob 


X"„=(YI^X.m) 

Relay M \ 



Eve 


Fig. 1. The considered cooperative PIN model with M relays. 

Eor Vm G {1, •' ’ i and Ya^tu denote the cor¬ 

relative source observations at Alice and relay m, respectively. 
Y^ b and Ye.m denote the correlative source observations at 
Bob and relay m, respectively. Specifically, Alice observes n 
i.i.d. repetitions of random variable Xa = {Yi^a, ' ‘ , Ym,a), 
denoted by ,F^^); Bob observes n i.i.d. 

repetitions of random variable Xb = (Fis,-- - ,Ym,b), 
denoted by X^ = (F"^, • • ■ , Y^ g); relay m observes n i.i.d. 
repetitions of random variable Xm = {YA,m,YB,m), denoted 
by X^ = (FX_„,F^^). This DMS model is a PIN in the 
sense that m 

/(F,„,F„,,;{F,-^,F^,, : {j,p) ^ (i,a)}) = 0, 

for i,j G {1, • • • G {A,B}. (1) 

This means that Alice and relay m have access to a pair 
{Ym,A, YA,m) which is independent of any other pair of source 
observations, so is (Ym,B, YB,m)- Note that there does not exist 
correlated source observations between Alice and Bob, the 
private key can be generated only via the help from the relays. 
Moreover, we do not consider correlated sources observed by 
any pair of relays, since the common randomness shared by 
any pair of relays cannot contribute to the private key rate. 

More definitions are given as follows. 

• Without loss of generality, assume that the nodes use the 
public channel to communicate in a round robin fashion 
over q rounds. Let \ < I < q and 1 < m < M. 
Specifically, relay m transmits during rounds I that satisfy 
/ mod {M+2) = m; Alice transmits during rounds / that 
satisfy I mod (M + 2) = M + Y, Bob transmits during 
rounds I that satisfy I mod (M -f 2) = 0. 

• A , • • • , 2"^‘>) code for the cooperative key gener¬ 
ation problem consists of : 

(i) M + 2 randomized encoders, one for each node. 
In rounds I satisfying I mod (M + 2) = m, relay m 
generates an index Fi G {1, •' ’ ,2"^'} according to 
p(/i|x^, in rounds I satisfying I mod {M + 2) = 


M + 1, Alice generates an index Fi G {1, •'' ,2"^*} 
according to /*“^); in rounds I satisfying I 

mod (M -1-2) = 0, Bob generates an index E] G 
{I,-- - ,2”^'} according to p{fi\xB, 

(ii) Two decoders, one for Alice (decoder 1) and the 
other for Bob (decoder 2). After receiving the q rounds 
of transmissions (i.e., F'^ = {Fi, • • • , Fg}) over the public 
channel, decoder 1 generates a random key Ka according 
to Ka = iTA(V2,F'J); Decoder 2 generates a random 
key Kb according to Kb = KB{Xg,F^). 

• A private key rate R is said to be achievable if there exists 
a (2”^E • • ■ , 2”^"!) code such that 

Pr{KA ^ Kb) <e, ( 2 ) 

-H{Ka) > i? - e, (3) 

n 

-7E(A:a) > -log|/CA| - e, (4) 

n n 

<e, forVmG{l,--- ,M}, (5) 

where \ICa\ denotes the size of the alphabet of the key 
Ka- Note that the secrecy constraints in Q implies that 
the relays are assumed to be non-colluding. 

• The private key capacity Ck is the supremum of all 
achievable rates R. is used to denote the private key 
capacity with deterministic encoding and key generation 
functions. According to im, = Ck, which means 
that randomization is useless for key generation in the 
addressed source model. 

III. Private Key Capacity of the PIN model 

Eor simplicity, we first define 

h = min {/(F,a; Fa.*), /(F.b; Fb.*)} , Vi G {1, • • • , M}. 

(6) 

Eurthermore, these parameters are ordered according to 1(1) < 
1(2) < ■ • ■ < I(M) ■ Then the private key capacity for the 
considered scenario is given in the following theorem. 

Theorem 1: Eor the considered PIN model with M relays, 
the private key capacity is given by 

M 


max Im 

i—1 

(7) 

M-1 


hi)- 

2=1 

(8) 


Proof: The achievability part is proved by a novel RB- 
based key generation algorithm that is based on two steps: key 
agreement and key distillation. In the key agreement step, Alice 
and Bob can agree on M common messages, each of which is 
revealed to a certain relay. In the private key distillation step, 
these common messages will be mapped into the final private 
key via a RB-based private-key codebook. 

The converse part is proved by deriving the upper bounds 
of M symmetric enhanced channels. Each of these enhanced 
channels relaxes the secrecy constraints and assumes Alice 
and Bob to be genie-aided (i.e., knowing part of the sources 
observed by the relays). 

The details of the proof will be provided as follows. ■ 
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A. Proof of Achievability 

Algorithm 1 briefly shows the achievable scheme that is 
based on two steps: key agreement and key distillation. Let 
RA,i = I{YA,i,Yi^A) - e, RB,t = I{YB,i,Y^^B) - e for 
1 < i < M; Ri = mm{Ri,A, Ri.B} = f and they 
are ordered according to < ••• < Ri^m)- Besides, 

Rkey = R(i)- 


Algorithm 1: Algorithm of Relay-oblivious Key Generation 


Step 1: Key Agreement: 

• Alice and Relay i agree on a pairwise key WA,i from 
the correlated observations {Yfj^^Y^f)'. Bob and Relay 
i agree on a pairwise key WB,i from the correlated 
observations iYfg,Yg,^), i = 1, - ■ ■ M. 

• Relay i sends WA,i 0 kfs.i over the public channel, 
so Alice and Bob can obtain both WA,i and WB,i, 
i = 1, - ■ ■ M. Then they will choose the one with a smaller 
size as the common message, denoted as Wi S Wi. 

Step 2: Key Distillation: 

• In advance, randomly grouped all the sequences in 

into bins each with equal amount of 

codewords. All the other nodes also know this private- 
key codebook. 

• Alice and Bob find the sequence = (Wi, • • • , Wm) 
in the RB based private-key codebook, and choose its bin 
number as the final private key. 


1) Key Agreement: In the key agreement step, Alice and 
Bob will agree on M common messages. 

First, each relay i and Alice agree on a pairwise key WA,i 
using their correlated sources iY '^each relay and 
Bob agree on a pairwise key using their correlated sources 
According to the standard techniques 121 ||2l, each 
pairwise key WA,i {WB,i) is generated using Slepian-Wolf 
coding and public transmission FA.i {FB,i)- Moreover, the 
pairwise keys WA,i and WB,i have the following properties 

Q, El: 

1) They can achieve the rates RA,i and RB,i, respectively; 

ii) They are uniformly distributed and can be decoded by 
both Alice and Bob correctly; 

iii) The pairs -.m}} are mutually 

independent, due to the definitions of the PIN model. 

Second, each relay i sends out Wa^i © ILb ^ over the public 
channel, so Alice and Bob can obtain both the two pairwise 
keys, and choose the one with a smaller size as the common 
message, denoted as Wi. Hence the rate of each common 
message Wi is Ri. According to M, 

-nwu--- .Wm;F<^) <ei. (9) 

n 

2) Key Distillation: In the key distillation step, both Alice 
and Bob map all the insecure common messages assembled 
from the key agreement step into the unique codeword in the 
private-key codebook, and set the bin number of this codeword 
as the final private key. Note that such a private-key codebook 


is generated based on random binning, so it provides necessary 
randomness such that the bin number is secret from all the 
relays and Eve. 

Remark 1: The main difference between the proposed al¬ 
gorithm and the one in ini lies in the key distillation step: 
the former is based on the RB process and the latter is based 
on an XOR process. In m, Alice and Bob concatenate 
{Wi © W 2 , • • • , Wm -1 © Wm) as the final private key in the 
key distillation step. Here M is assumed to be even. 

We will provide more details of the RB-based codebook in 
the following. 

Codebook Generation: Let Wi G Wi = {I,-- - ,2”^*}, 
= (wi,--- , wm )- Then, based on the concept of ran¬ 
dom binning, the private-key codebook can be constructed. 
Specifically, randomly and uniformly partition all the elements 
in set = Wi x W 2 x ■ • ■ x Wm into 

bins each with codewords. So each codeword 

can be indexed as {k, k), where k G {1, • • • , 2"^^'"!'“'^)}, 

G {1, • • • , Fig. |2] illustrates the binning assign¬ 

ment for the private-key codebook, denoted by C, that is known 
by all nodes (including Eve). 


1 2 





bin 1 


bin 2 


bin 2 




Fig. 2. The binning assignment for the private-key codebook, where = 
(mi,-- - ,wm) G WiG {!,■■■ 


Decoding and key generation: Based on the common 
messages collected in the key agreement step, Alice and 
Bob can find their corresponding indices in the private-key 
codebook. Specifically, knowing (Wi,--- ,Wm), Alice finds 
the index pair {k, k) from the private-key codebook such that 
w^{k,k) = (Wi,-- - ,Wm)- Then, it sets its key Ka = k. 
Similarly, Bob can also correctly find the key Kb = k. Since 
the error probability of the event that Alice and Bob share 
the same (Wi, • • • , Wm) is insignificant, the error probability 
P{Ka f- Kb) is arbitrarily small as n —> 00. 

Analysis of the key rate: Since the private-key codebook 
is based on the random binning process, Ka is uniformly 
distributed over {1, • • • , averaged over the code¬ 

book (i.e., C). Therefore, it can be obviously obtained that 

H{Ka\C) = n{Rkey - e). 

Analysis of the secrecy constraints: For Vm G 

{1, • • • ,M}, we will prove that the generated private key is 
secret from relay m. Define W^ = (Wi,--- ,Wm)- Then, 
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averaged over C, we have 

I{Ka;F‘^,x:^\C) < I{Ka;F'^,W^\C) 

< I{Ka; Wm\C) + I{Ka, W^-F‘l\Wm,C) 
(b) 

< I{KA;Wm\C)+nei 

= I{KA;Wm\C) + nei. (10) 

where (a) is due to the fact that — {Wm,F'^) — Ka is 
a Markov chain; (b) is due to (|9]l and the fact that Ka is 
determined by for a given codebook. Furthermore, 

I(Ka; Wm\C)=I{KA, W^- Wm\C)-I{W^; W^\Ka, C) 
= I{W^^;W^\C)-H{W^\KA,C) + HiW^\W^,KA,C) 
= H{W^\C)-HiW^\KAfi) + H{W^\Wm,KA,C). (11) 
For the first term, obviously we have 

H{Wm\C) = nRm. (12) 

Since F[(Wi\C) = nRi, we have F[{W^\C) = 

So the second term can be obtained as 

H{W^\Ka,C) = H{W^\C) + H{Ka\W^,C) - H{Ka\C) 
= H{W^\C)-H{Ka\C) 

M 

— rr ^ ^ F[i) ‘l^i^Rkey t:) 

i=l 

= n{R(^M) + e)- (13) 

The third term is bounded in the following lemma. 

Lemma 2.- When i?(M) = max{i?i,--- ,i?M} and n is 
sufficiently large, 

H{W^\Wm.KA,C) <n{R^M) - Rm + m)- (14) 

Proof: This lemma can be proved using similar methods in 
existing related works, such as ini (proof of Lemma 22.3) and 
m, with some necessary variations. The details are omitted 
here due to space limitation. ■ 

Combining (fTOl) with (fTTI) . (fTSl i. (fTsT l and (fT4l i. we have 

-I{KA]FfXl\C) < h{KA-,Wm\C) + 
n n 

< <)(c) + £i — £■ (15) 

So the private key rate Rkey = ^{i) ~ e is achievable. 

B. Proof of Converse 

The calculation of the upper bound is based on M symmetric 
enhanced channels. For the m-th enhanced source model, m = 
1, • • • ,M, we only consider the secrecy constraint on relay 
TO, and ignore the secrecy constraints on all the other relays. 
Moreover, Alice and Bob are assumed to know the observations 
of two subsets of relays a priori, respectively. The definitions 
of the two subsets are given as follows. 

For a given to € {1, ■ ■ ■ , M}, we will form two sets 
of nodes, i.e., A]m[ and in the next. First, allocate 

Alice and Bob to A]m[ and respectively. Second, for 

relay i, i f m, if I{Yaa;Y^^a) > I{YB,i',Y^i,B), allocate it 
to A]m\^, otherwise, allocate it to B]m[- So HYb^uYi^b) = 
Ta:in{I{YA,i]Yi^A),I{YBYYi^B)} if relay i lies in A]m[, and 


I{YA,i-,Yi^A) = min{I{YA,i]Yi^A)A{YBA\Yi,B)} if relay i 
lies in S]„[. 

Then, assume without loss of generality that relays Ai, 
A 2 , • • ■, Aj are allocated to A]m[, and relays Bi, B 2 , 
• ■ • , Bm-i-j are allocated to 0 < j < M — 

10. Here {Ai,-■ ■ ,Aj}f]{Bi,-■ ■ ,BM-i-j} = 0 and 

{Ai,--- ,Aj}[j{Bi,--- ,BM-i-j} = {1, • • • ,TO - 1,TO + 
1, • • • ,M}. In other words, A]m[ = {Alice, relays Ai, •••, 
Aj}; B]mi ={Bob, relays Bi, •••, Bm-i-j}- Now, by the 
max-flow principle H], the max follow between the two sets 
A]m[ and B]rnl can be expressed as R ~ ^rn, which is 

the upper bound of the TO-th enhanced channel. Due to space 
limitation, the details are omitted here. 

Choosing the smallest bounds among all the M enhanced 
channels, we can obtain Ck < ~ rnax^g^^ ... Im- 

IV. Key Generation in Wireless Network 

In this section, we will extend the RB-based algorithm 
proposed for the PIN model into the wireless network, and use 
the estimates of wireless fading channels as source observations 
for private key generation. 

A. Model 

The considered wireless network can be viewed as a practical 
example of the PIN model in Section |II] All the nodes have a 
single antenna and are half-duplex constrained. In this wireless 
network, it is assumed that there is no direct link between 
Alice and Bob, since they are located far from each other. 
Denote liAj {hB,i) as the fading channel gains between relay 
i and Alice (Bob). All channels are assumed to be reciprocal. 
It is reasonable to assume that all the fading channel gains 
and noise are random variables and independent of each other. 
An ergodic block fading model is considered, in which all the 
channel gains remain constant for a block of T symbols and 
change randomly to other independent values after the current 
block. For simplicity, we assume Baa ^ ^(0, Iiba ~ 
Moreover, none of the nodes knows the values of 
hA,i and Iiba a priori, but all the nodes know their statistics. 

Assume that terminals transmit in a time-division manner. 
For L channel uses, let - = 

[syi(l),--- ,sa{La)]'^ and Sb = [ss(l),-- - ,sb{Lb)]'^ de¬ 
note the signals sent by relay i, Alice and Bob, respectively, 
where i = 1, • • ■ , M, and La + Lb + = L. For 

simplicity, we consider an equal power constraint for the 
legitimate terminals, that is 

^E{Sf S,}, ^EjS^S^}, ^E{S{;Sb} < P. (16) 

Li La Lb 

B. Proposed RB-based Algorithm 

The proposed RB-based algorithm (Algorithm 1) can be 
extended to wireless networks for private key generation. 
Briefly speaking, all the relays, Alice and Bob take turns to 
broadcast training sequences. After the channel estimation step, 
Alice and Bob will generate the private key using the RB-based 
scheme in Algorithm 1 (Sectionlllll). Now, we will explain the 

*lf j = 0, - ,j4,} = 0 and A\m\ = {Alice}; if } = M — 1, 
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channel estimation step in more detail. Fig. [3 shows the time 
frame for the training of the proposed scheme in each fading 
block. Each fading block is divided into M + 2 time slots, and 
the numbers of symbols in these time slots are Ti, • • • ,Tm, 
Ta, Tb, respectively, where TA+Ts+J^fLi Tm = T. Suppose 
relay i, Alice and Bob sends known training sequences 
of size 1 X Ti, Syi of size 1 x and of size 1 x Tb, 
respectively. The energy of each sequence is ||Si|p = TiP, 
||Sa|P = TaP, ||Ss|p = TbP, where || • j| denotes the 
Euclidean norm. 



T 






1) Relay 1 sends 


M) Relay M sends 

M+\) Alice sends 

Af+2) Bob sends 

Si 


S,w 

S.4 

Sfl 

■ T’ , 


rr 



' 




• Ig ► 


Fig. 3. Time frame for the training phase in each fading block. 

Erom n fading blocks, Alice can obtain the estimates 
iKAr--.h-A)-^ Bob can obtain the estimates 
rsl^y * can obtain the estimates 
* = 1, • ■ • , M. These estimates are noisy 

versions of the corresponding fading channels. The details of 
this channel estimation step are omitted here due to space 
limitation, and similar works can be found in ifTTl . fm . The 
rate of each pairwise key Wa,i can be calculated as 


existing scheme suffers a loss of M/2 multiplexing gain in 
comparison with the case without secrecy constraints at the 
relays. Hence the proposed RB-based scheme can effectively 
enhance the performance of the private key generation. 

V. Conclusion 

In this paper, we have investigated the problem of private 
key generation. A particular cooperative PIN model with M+2 
terminals is considered, where Alice, Bob and M relays 
observe pairwise independent sources. Under the help of relays, 
Alice and Bob wish to establish a private key that is secure 
from Eve and all relays. The private key capacity of this 
PIN model has been found. The achievability is proved via 
a novel RB-based algorithm for generating the private key. 
The upper bound of the private key capacity is obtained by 
considering M enhanced source models. Then, we further 
consider a cooperative wireless network, in which estimates 
of wireless channels are regarded as the correlative source 
observations. Compared to the XOR-based algorithm in ini 
whose multiplexing gain is [MJ/2, the proposed RB-based 
algorithm achieves a larger multiplexing gain M — 1. 
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(17) 


where <5^ is the variance of each Gaussian noise. 

Now, using the result in Theorem[Tl the proposed RB-based 
algorithm achieves the private key rate R^f.y for some tuple 
{Ta, Tb,Ti, - ■ ■ , Tm), which can be written as 


R 




max 

,M} 



(18) 


with if = min{i?^ j, Rg j}. To further show the impact of the 
proposed scheme on the gain of the key rate, the multiplexing 
gain (introduced in ifTnH is analyzed as following. 

Corollary 3: Eor the considered wireless network with M 
relays, the multiplexing gain of the private key rate achieved 
by the proposed RB-based algorithm is M — 1. 

Proof: Based on the definition of in IfTTl . the multiplexing 
gain of the proposed algorithm should be limp_^oo where 
ss ^ log P as P ^ oo. Erom Eq. (fTTl i. it is easy to obtain 

that limp_>oo = T, so we have limp^oo = M — 1. 


Remark 2: If there is no secrecy constraints at the relays, 
the multiplexing gain is M IfTTl . So the proposed RB-based 
algorithm sacrifices one multiplexing gain for satisfying the 
secrecy constraints at all the M relays. This loss is insignificant 
because only one multiplexing gain is sacrificed, no matter 
how large M is. But for the XOR-based algorithm in IfTTl 
(Corollary 10), its multiplexing gain is [M/2J if there does 
exist the direct link between Alice and Bob. Therefore this 
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